/**
 * Reading a Pod AI credential's secret.
 *
 * AI Connections stores the provider secret as an `encryptedSecret` envelope
 * (plaintext JSON envelope locally, a wrapped secret cell in Cloud), while some
 * older rows carry a bare `apiKey` property. Every consumer that needs the key —
 * the Gateway for chat, and the embedding/indexing paths — must read the secret
 * the same way, otherwise a key entered through AI Connections works for chat but
 * not for embeddings.
 */
export declare const PLAINTEXT_CREDENTIAL_ALGORITHM = "PLAINTEXT";
export interface AiCredentialSecretContext {
    webId: string;
    /** Credential resource IRI, when the caller knows it (required by wrapped envelopes). */
    credentialIri?: string;
    /** Provider id, when the caller knows it (required by wrapped envelopes). */
    provider?: string;
}
export type AiCredentialSecret = Record<string, unknown>;
export type AiCredentialSecretDecoder = (row: Record<string, unknown>, context: AiCredentialSecretContext) => Promise<AiCredentialSecret | undefined> | AiCredentialSecret | undefined;
/**
 * Default decoder: bare `apiKey`, the `plaintext-v1` payload shape, and the
 * `PLAINTEXT` envelope AI Connections writes locally. Wrapped envelopes return
 * `undefined` so a caller with a credential vault can decode them.
 */
export declare const defaultAiCredentialSecretDecoder: AiCredentialSecretDecoder;
export declare function decodePlaintextAiCredentialSecret(row: Record<string, unknown>): AiCredentialSecret | undefined;
export declare function parseCredentialEnvelope(value: unknown): Record<string, unknown> | undefined;
/** Token fields a decoded secret may carry instead of `apiKey`. */
export declare function providerTokenFromSecret(secret: AiCredentialSecret | undefined): string | undefined;